Submitted April 6, 2016 by Carolyn D. Walker, Attorney Stoel ...media.oregonlive.com/politics_impact/other/investigation.pdfCarolyn D. Walker, Attorney Stoel Rives LLP Case 6:16-cv-02052-TC

INVESTIGATION REPORT Submitted April 6, 2016

by

Carolyn D. Walker, Attorney

Stoel Rives LLP

Case 6:16-cv-02052-TC Document 1-1 Filed 10/26/16 Page 1 of 32

i

Table of Contents

I. Background ........................................................................................................................1

Criminal Intelligence Unit .....................................................................................1

II. Investigation Methodology ................................................................................................3

III. Findings ...............................................................................................................................4

IV. Witness Interviews and Observations ..............................................................................7

1. —Research Analyst 3 ....................................................................7

2. —Research Analyst 3 .....................................................................8

3. —Research Analyst 3 ................................................9

4. —Research Analyst 3 ..............................................................11

5. —Special Agent ...............................................................12

6. —Special Agent ....................................................................17

7. David Kirby—Special Agent in Charge .............................................................18

8. Darin Tweedt—DOJ Chief Counsel ...................................................................20

9. —Research Analyst 4 ..................................................................23

10. Steven McIntosh—Assistant Special Agent in Charge of CJD ........................24

11. Matt McCauley—Assistant Attorney General ..................................................26

V. Conclusions and Recommendations ...............................................................................28


1

I. Background On November 4, 2015, I was contacted by Lisa Umscheid, an attorney with the Oregon Department of Justice (“DOJ”), regarding my availability to conduct an investigation into the use of a digital monitoring software platform by at least one employee of the DOJ’s Criminal Justice Division (“CJD” or “division”). By contract effective November 10, 2015, the DOJ retained me under the supervision of the DOJ’s Supervising Attorney, Ms.Umscheid, to (a) conduct an investigation into any improper conduct and performance of employees with regard to their compilation, analysis, monitoring and use of digital information (such as content posted on websites, social media or Twitter feeds) in the course of any work performed as employees of DOJ; and (b) advise DOJ regarding the scope of an audit of the CJD’s compilation, analysis, monitoring and use of digital information in connection with the division’s work. This investigation was initiated by order of Oregon Attorney General Ellen Rosenblum after she learned that DOJ/CJD employee, , used social media monitoring software that was being tested for potential purchase by the DOJ to conduct a search using search terms including #blacklivesmatter. The search resulted in a review of the Twitter account of Erious Johnson, Jr., Director of Civil Rights for DOJ and Office of Attorney General, and generated a report on the outcome of the search. The Attorney General notified Mr. Johnson of this report, subsequently called for this investigation into the matter and placed on administrative leave pending the outcome of the investigation.

is an investigator assigned to the Oregon TITAN Fusion Center, which is a unit within the CJD’s Criminal Intelligence Unit. An overview of the Criminal Intelligence Unit, as provided in writing by former DOJ Chief Counsel Darin Tweedt, is set forth below:

Criminal Intelligence Unit The ability to gather and analyze information about criminals and their organizations is invaluable to law enforcement agencies.1 The Criminal Intelligence Unit, aka

1 The benefits of gathering and analyzing criminal information was recognized by

the Oregon legislature in 1977 when it directed the Department of Justice to: (2) Establish a coordinated system of collecting, storing and disseminating information relating to organized crime. (3) Develop and maintain a liaison between local, state and federal law enforcement agencies in Oregon, assisting them in the investigation and suppression of organized criminal activity and encouraging cooperation among those agencies. (4) Conduct comprehensive factual studies of organized criminal activity in Oregon, outlining existing state and local policies and procedures with respect to organized crime, and formulating and proposing such changes in those policies and procedures as the department may deem appropriate.

(continued . . .)


2

Criminal Intelligence Center, facilitates the gathering, analysis and sharing of criminal information with local, state and national law enforcement agencies. The Unit is composed of the Oregon TITAN Fusion Center, the Oregon HIDTA Investigation Support Center, and the Oregon HIDTA Watch Center.

• Oregon TITAN Fusion Center: The Fusion Center is Oregon's focal point for receiving, analyzing, gathering, and sharing threat-related information in order to better detect, prevent, investigate, and respond to criminal and terrorist activity.

The Fusion Center is composed primarily of staff from the Criminal Justice Division.2 This staff works in conjunction with federal, state and local law enforcement agencies. The Fusion Center produces threat assessments3, officer safety bulletins, general crime bulletins and terrorism related bulletins. In addition, the Fusion Center is an essential component of the state’s critical infrastructure review process. The Fusion Center also provides criminal analysts to assist federal, state and local law enforcement agencies with criminal investigations. Finally, the Center provides important training to law enforcement agencies, businesses and first responders about active shooters and the latest terrorist trends, techniques and procedures.

• High Intensity Drug Trafficking Area (HIDTA) Investigation Support Center: The Investigation Support Center is a co-located multi-agency program. Its mission is to promote, facilitate, and coordinate the exchange of criminal intelligence information, and provide analytical support. The Criminal Justice Division has five Research Analysts assigned to the Investigation Support Center.

(. . . continued) ORS §180.610 (2), (3) (4).

2 The Criminal Justice Division component is one attorney, one Special Agent, five Research Analysts and an IS Specialist.

3 A threat assessment is the “[p]rocess of identifying or evaluating entities or events for indications of potential harm to life, property, operations or information. These assessments involve investigative research which results in a written product identifying possible threats to a specific person or incident. Examples include Pendleton Round-up, Hillsboro Air Show or Governor's Inauguration. Threat assessments may be conducted by an individual or team of analysts based on the complexity of the assessment.” Oregon TITAN Fusion Center Procedure, Threat Assessments/Risk & Vulnerability Assessments, September 18, 2015.


3

• High Intensity Drug Trafficking Area (HIDTA) Watch Center: The Watch Center's primary mission is to enhance officer safety through deconfliction

4 for the designated HIDTA counties. Watch Center analysts also provide tactical analytical support to law enforcement officers throughout Oregon. The Criminal Justice Division has three Research Analysts and a supervisor assigned to the Investigation Support Center.

See Ex. A (November 25, 2015 Memorandum from Darin Tweedt). II. Investigation Methodology

Prior to conducting witness interviews, I met with various DOJ employees to obtain background information on the CJD and the circumstances that led to the decision to conduct the investigation that is the subject of this report. These individuals included: DOJ Senior Assistant Attorney General Lisa Umscheid, Deputy Attorney General Fred Boss and DOJ Special Counsel on Public Safety Michael Slauson.5

Beginning December 15, 2015, I conducted face-to-face interviews with CJD employees

and obtained background information and documents relevant to the Attorney General’s concerns. At the start of each interview, I explained my role as an investigator hired by DOJ to conduct an investigation into the facts and provide recommendations to DOJ. I explained that the statements made by the witnesses would be shared with the DOJ, but that the witnesses should not discuss our interview with others.6 I also explained the Garrity rights notices that were provided to the witnesses. I reminded these employee witnesses that there could be no retaliation either by or against them for anyone’s participation in the investigation, and to immediately notify HR if they experienced retaliation. I provided the witnesses with my business card and invited them to contact me if they had any other information or documentation to share.

4 Deconfliction is a process designed to ensure that multiple agencies are not inadvertently targeting the same event, individual, or organization. Deconfliction occurs when officers of one investigative agency are notified that officers of another agency may be conducting operations in the same area or may be investigating the same suspect. Deconfliction prevents costly duplication of investigative effort and compromise of investigations. Most importantly, deconfliction directly impacts officer safety by reducing the chances two law enforcement agencies, unbeknown to each other, are carrying out undercover law enforcement operations in the same area.

5 Mr. Slauson has since assumed the position of Acting Chief Counsel of the CJD.

6 Note, I have been informed that under the terms of their collective bargaining agreement, union employees are permitted to engage in discussions with others regarding the investigation.


4

To better understand the search methodology used by and others, I requested training on the software that was used for the search. The company that developed and owns the software (“Digital Stakeout”) that was used for the search cooperated with DOJ’s request to provide me with an abbreviated general overview demonstration/training on the software. I further requested that the DOJ conduct a thorough search of CJD computers used by

to determine the scope of his searching and activity regarding #blacklivesmatter and other relevant search terms.

As part of my investigation, I requested a copy of all CJD policies, procedures or protocols relevant to privacy rights of individuals and groups and how and when information could be gathered. I received and reviewed the following division policies:

o Oregon TITAN Fusion Center Privacy Policy. See Ex. B. o Social Media Non-Covert Investigation Policy 3-101.5 dated July 31, 2015. See Ex. C. o Fusion Center Procedure for Threat Assessments dated September 18, 2015. See Ex. D. o Oregon TITAN/Fusion Center Policy Regarding First Amendment Protected Events. See

Ex. E. I also reviewed the following statutes and regulations relevant to CJD employees:

o 28 CFR Part 23 regarding Criminal Intelligence Systems Operating Policies. This federal regulation applies to state agencies if they are operating inter- or multi-jurisdictional criminal intelligence systems that are supported with Crime Control Act funding. The regulation forbids the collection or maintaining of criminal intelligence information about the political, religious or social views, associations or activities of any individual or any group, association, corporation, business, partnership or other organization unless such information directly relates to criminal conduct or activity and there is reasonable suspicion that the subject of the information is or may be involved in criminal conduct or activity. See 28 CFR §23.20(b).

o ORS §181.575 (now recodified as ORS §181A.250) states that “no law enforcement agency, as defined in ORS §181.010 (Definitions for ORS §§181.010 to 181.560 and 181.715 to 181.730), may collect or maintain information about the political, religious or social views, associations or activities of any individual, group, association, organization, corporation, business or partnership unless such information directly relates to an investigation of criminal activities, and there are reasonable grounds to suspect the subject of the information is or may be involved in criminal conduct.”

My findings, summary of the interviews and observations, conclusions and recommendations are below. III. Findings 1. In early 2015, Chief Counsel Darin Tweedt directed Special Agent In Charge Steve McIntosh

to identify and test social media monitoring software (“SMMS”) programs that could be helpful in criminal investigations supported or conducted by the CJD.


5

2. On September 29, 2015, certain CJD employees within the Intelligence Unit were given a demo and some training by the vendor of an SMMS product, Digital Stakeout. Digital Stakeout takes user specified keywords and searches multiple open source social media sites, and returns results that can be pinpointed to a geographic area specified by the user. The vendor allowed the employees to use Digital Stakeout on a free trial basis after the demo, and some employees tested it for a period of time. 7

3. On September 30, 2015, Agent used Digital Stakeout to conduct a search on the keyword search term “#blacklivesmatter” combined with “#fuckthepolice” (“the search”). He focused his search on Salem, Oregon, which yielded results that included Twitter posts by Erious Johnson, Jr. believed that some of Mr. Johnson’s posts were threatening to the police and he verbally shared his concerns with Special Agent in Charge David Kirby.8

4. Mr. Kirby verbally described the concerning posts to Mr. Tweedt, and based on the description, Mr. Tweedt recommended to Deputy Attorney General Fred Boss that

prepare a report on his search and the findings. Mr. Boss approved this recommendation and was then directed to write the report.

5. On October 1, 2015, prepared and presented to Mr. Kirby a report he referenced as “Possible threats towards law enforcement by DOJ employee.” This report was a single page memo with an attachment that included several pages of posts that

printed directly from Mr. Johnson’s Twitter feed rather than from Digital Stakeout. See Ex. F.

6. On October 8, 2015, Mr. Kirby delivered the report to Deputy Chief Counsel Stephanie Tuttle. In an email to Mr. Tweedt, Mr. Kirby reiterated his concerns about the crosshairs image and gave Mr. Tweedt a detailed description of the image and the accompanying language. Upon reading Mr. Kirby's detailed description, Mr. Tweedt emailed Mr. Kirby that the image was actually the logo for the “rap group” Public Enemy. See Ex. G.

7. On October 8, 2015, Ms. Tuttle left report on Mr. Tweedt’s office chair. 8. On October 12, 2015, upon his return from out of town travel, Mr. Tweedt reviewed the

report. 9. On October 13, 2015, Mr. Tweedt gave the report to Mr. Boss, who at some point thereafter

gave the report to Attorney General Ellen Rosenblum. 10. On October 20, 2015, the Attorney General called Mr. Tweedt into a meeting with herself

and Mr. Boss, during which she expressed her extreme displeasure over the report by because she believed he had engaged in racial profiling. She instructed Mr. Tweedt

to find anti-racial profiling training for the Special Agents, and ordered that all SMMS use be immediately discontinued.

7 Another SMMS program that was being considered for use by the Intelligence Unit was

X1, but it appears to only have been used on a very limited basis by Research Analyst to conduct a keyword search on the word based on some activity with

8 Note that none of Mr. Johnson’s tweets that were attached to October 1, 2015 memo contained any reference to “fuck the police.”


6

11. On or about October 20, 2015, at the direction of Mr. Tweedt, Steve McIntosh verbally notified some employees to discontinue use of Digital Stakeout. It is unclear whether he notified all of the employees at that time, as there are conflicting accounts of who received this verbal notice and when it was received.

12. On November 10, 2015, was placed on administrative leave pending the outcome of this investigation.

13. On November 12, 2015, Mr. McIntosh sent an email to all subject employees to discontinue use of Digital Stakeout. See Ex. H.

14. All other employees, except , had stopped any active use of Digital Stakeout at or before the time Mr. McIntosh issued his November 12, 2015 email.

15. The trial version of Digital Stakeout that was being used by employees was not enabled to keep a record of searches conducted by employees, so the search terms could not be verified independently from the list provided to this investigator that the employees reported having used.9

16. Digital Stakeout allows users to access only open source (publicly available) information, and does not allow users to breach information that is protected by privacy settings. None of the searches conducted by and other employees using Digital Stakeout accessed non-public information on Mr. Johnson or others.

17. Mr. Johnson was not specifically targeted for investigation by or the DOJ. 18. conducted the search of the terms that resulted in finding Mr. Johnson’s

Twitter posts of his own volition, and not under any direct or implied orders of the DOJ. 19. The Intelligence Unit is subject to federal 28 CFR Part 23 regarding Criminal Intelligence

Systems Operating Policies and to its state equivalent, ORS §181.575 (now recodified as ORS §181A.250) , as well as the unit’s own policies regarding privacy and free speech rights of individuals and groups. These policies apply regardless of whether the information being gathered or sought is obtained while engaged in a training exercise or while conducting substantive work.

20. search was not in compliance with 28 CFR Part 23, ORS §181.575 or the Intelligence Unit’s Privacy Policy.10

21. Once conducted the search, the lack of a diverse or alternative point of view regarding the import of the search results contributed to the belief that Mr. Johnson’s posts constituted a potential threat to the police.

22. was verbally directed to prepare a written memo based on his description of the search results and his belief that the posts constituted a potential threat to police.

23. Intelligence Unit employees either are not uniformly provided with copies of all relevant departmental policies, or do not recall having received all such policies.

9 The combined list of search terms any of the employees reported using is included in a

November 9, 2015 email from Mr. McIntosh to Mssrs Tweedt and Kirby and Stephanie Tuttle. See Ex. I.

10 Depending on whether he obtained prior written authorization from a superior, actions may also be out of compliance with the Social Media Non-Covert

Investigation Policy 3-101.5.


7

24. Intelligence Unit employees are either not receiving or taking advantage of relevant training offered on applicable laws and departmental policies on a consistent basis.

25. Intelligence Unit employees have not received adequate cultural competency training, or training on anti-racial profiling , hidden or implicit bias, and/or diversity training.

26. The Intelligence Unit is in the process of updating its policies and training procedures and implementing a system to maintain the policies and more consistently mandate and track the training.

27. The Intelligence Unit has taken steps to implement anti-racial profiling training for its employees and plans to move forward with the training pending the outcome of this investigation.

IV. Witness Interviews and Observations Between December 15, 2015 and March 16, 2016, I conducted recorded interviews of several DOJ/CJD employees.11 These employees were selected for interviews because they either participated in the training on the use of Digital Stakeout and/or used Digital Stakeout at some point; had some pertinent communication with after he conducted the #blacklivesmatter search (“the search”); were in the supervisory chain of command over

; and/or were involved with CJD actions taken after the search.

1. —Research Analyst 3; employed since 4.10.2000 (interviewed on December 15, 2015 and March 9, 2016)

was accompanied by her union representative, Joe Ederer. is assigned to the Fusion Center. She attended the demonstration/training for Digital Stakeout, but thinks it was at the end of October 2015 (the demonstration was actually on September 29, 2015), along with and . believes she never used Digital Stakeout outside of the September 29 training, except once to sign on another member. She had previously conducted a search through the X1 Social Discovery platform using the search term because David Kirby wanted her to conduct the search based on some activity with .

reviews social media sites of individuals only in the context of providing case support to law enforcement agencies, and has never conducted any information gathering on individuals who were not part of a criminal investigation. She is familiar with 28 CFR §23 and understands it applies to her, and that by extrapolation so does ORS

11 Note that on March 4, 2016, I contacted Mr. Johnson to invite him to meet with me in

the event he had information to share that might aid in the investigation, given that it was his Twitter feed that brought the issue of activity to light. Mr. Johnson expressed his willingness to answer any specific questions, but declined to meet with me as he had no independent information relevant to this investigation.


8

§181.575. She is unfamiliar with the September 18, 2015 Fusion Center Procedure for Threat Assessments, and she does not typically conduct threat assessments. When threat assessments are conducted, the assessment is targeted toward an event (such as the Hillsboro Air Show) to determine whether the event is subject to a threat, rather than conducting an assessment to determine whether a particular individual is considered a threat. She is familiar with the Fusion Center Privacy Policy and has received formal online training within the last year on some of the information contained therein.

does not have the ability to access emails of individuals, which requires a subpoena. She does not conduct surveillance in her position, and does not know whether individuals whom she has conducted research on based on a law enforcement request are subjected to surveillance after she submits her search results to law enforcement.

attended the September 29, 2015 vendor demonstration/training on Digital Stakeout along with others in her department. Sometime after the training, showed a map location with a “dot on it,” which represented the building they were in, but she does not recall the search terms he used to obtain that geographical location result. expressed surprise that someone in the building was expressing views that felt presented an officer safety issue. The next time she heard anything about the search conducted was when it came out in the media. was told verbally (she believes sometime in September or October) that the department could no longer use Digital Stakeout or other social media monitoring platforms by either David Kirby, Steve McIntosh or another employee, and also later received a November 12, 2015 email from Mr. McIntosh that they were to discontinue use. At the time was put on administrative leave (November 10, 2015),

was not using the software at all to conduct searches.

has been trained on 28 CFR §23 and recognizes there are some search terms that would be inappropriate, such as conducting a search based on a person’s religion, political views/party affiliation, race or sexual orientation, etc. She is not aware of anyone in her department conducting such searches.

has not been given any training on racial bias, hidden biases or racial profiling, but has had diversity training in the past.


was accompanied by her union representative, Mr. Ederer. has been assigned to the Fusion Center since October 1, 2015 and prior to that was an analyst assigned to the High Intensity Drug Trafficking Areas (“HIDTA”). She is familiar with Digital Stakeout, and she was given access to it although she never used it and did not attend the September 29, 2015 demonstration provided by the vendor.

showed how the “geofence” component on Digital Stakeout worked on the computer in his office either on September 29 or 30, 2015. The next day,

showed on his computer a search he had conducted using



10

unsatisfied with the results he was getting, so he went back to using Google and watching the news to get updated information. also used terms similar to “no new animal labs” in light of demonstrations that were occurring in Seattle, but did not get a lot of useful information. On November 12, 2015, Mr. McIntosh sent an email telling employees to stop using Digital Stakeout. During his December 15, 2015 interview, stated that he was not aware of

“black lives matter” search until after was put on administrative leave (which was on November 10, 2015). During the March 9, 2016 follow-up interview, stated that Mr. McIntosh had previously walked down the center walkway in the department and given verbal instruction that there was to be no more use of Digital Stakeout until the issues were taken care of— believes this was prompted by the “black lives matter stuff.” It has been ingrained in during his many years of law enforcement that the only time it is appropriate to research an individual or group is during an active criminal investigation. He has had training on what is appropriate or legal in terms of gathering and maintaining information on individuals. The department follows the Fusion Center Privacy Policy, and has a practice of checking with its attorney (Matt McCauley) on reviewing all the work product it creates (before disseminating it). understands that it is impermissible to look into the social, political or religious beliefs of individuals unless there is some tie to criminal activity, and that if there is any question to check the legality with Mr. McCauley.

helped write the Fusion Center Privacy Policy and is familiar with federal and state laws/regulations related to privacy issues. Other CJD Fusion Center employees receive training on the Privacy Policy, and Mr. McCauley provides training on the policy and the laws at the DOJ conferences in March of each year. All employees do not go every year, but do go at some point. The Privacy Policy was implemented, and all employees should have a copy of it to ensure that they do not gather information illegally. Examples of search terms that would not run include “the Elks,” “the church” or “Occupy,” unless there was a crime that had been committed or a terrorism nexus for some impending bad action related to the terms. It would also be unacceptable to use the search term “Black Lives Matter” unless looking up specific individuals associated with the term that had committed a crime.

has seen the September 18, 2015 Fusion Center Threat Assessments Procedure, but has not seen the July 31, 2015 Social Media Non-Covert Investigation Policy. The department does not engage in gathering personal information, such as credit card, telephone or cell phone usage, on individuals without a search warrant. It does not conduct surveillance, does not review individuals’ online browser histories and does not have the ability to look into individuals’ emails. Prior to gathering information on an individual, some criminal predicate would need to exist—for example, if there is a request from a police department, a case number must be provided to ensure there is a legitimate crime before Fusion Center employees start to gather information.


11

The HR department has conducted diversity training in the department within the last two years. There has been no training on racial bias in the context of determining threats, and no training on racial profiling issues, although believes the Attorney General wanted to have such training. They have received no training on cultural competency or hidden biases.


was accompanied by her union representative, Mr. Ederer. She has been

assigned to the Fusion Center since July 2011. attended the Digital Stakeout training demonstration on September 29, 2015 and used a keyword search on the Animal Liberation Front (“ALF”) in the Seattle area, as there was trouble with protestors targeting the University of Washington. stated that ALF is recognized by the FBI as a criminal organization. did not actively use Digital Stakeout after attending the demonstration. However, she continued to receive emails from Digital Stakeout that her search was too broad. She thought she had disabled it around the end of October, although she learned later that it was still running.14

learned that had done the #blacklivesmatter search using Digital Stakeout. At the time of her interview, did not know whether she had ever used that search term, but she later recalled that on September 10, 2015, she sent a bulletin alert related to #blacklivesmatter to other law enforcement agencies. See Ex. J.

does not think she would have known not to use the search term prior to learning how the “Attorney General feels about that.” Because of the aftermath of

search, would check with the attorney in the department’s unit (Mr. McCauley) prior to putting in any search term going forward. Most of

searches are related to matters such as “school bomb threat in Salem, Oregon.” She would not search a term like “#Muslim,” because that is a reference to religion, but she might search “#extremists.” stated she was not currently searching hashtags and did not know whether she ever would again. She stated that she had not been given training on what would be an inappropriate social media search term, but that Mr. McCauley talks with the employees fairly often about civil rights and civil liberties. stated that a couple of years ago Mr. McCauley had provided an entire CJD training on privacy rights and individuals not being subject to searches, and then a year ago he trained two newly hired analysts on these issues while sat in on the training. understands that individuals have a right to protest and cannot be reported for it, but that if they engage in criminal acts while protesting, the criminal behavior can be the subject of a report.

14 Digital Stakeout allows a user to create an ongoing search that will continue even after

logging out of the system until the user disables the ongoing search.


12

Mr. McCauley told he would have counseled against conducting the search if had come to him first, and that he was disappointed that it had happened.

is familiar with the TITAN Fusion Center Privacy Policy, but she tends to go to Mr. McCauley if she has questions. had not been aware of the July 31, 2015 Social Media Non-Covert Investigation Policy until Mr. McIntosh had her sign off on having received it two weeks prior to this interview, and the only copy of the document she has seen was during the interview. believes she received a copy of the September 18, 2015 Fusion Center Procedure for Threat Assessments. She previously had training on 28 CFR Part 23, most recently sometime in November 2015. She is aware that it applies to social media searches and that it applies to both analysts and investigators. is not as familiar with the state equivalent, ORS §181.575, and believes she is more familiar with the Oregon Administrative Rules (“OARs”) on the subject.

did not receive a verbal directive from Mr. McIntosh on or around October 20, 2015, to discontinue using Digital Stakeout, and she first learned that the employees were not to use it when she received his November 12, 2015 email.

has not received training on racial bias, diversity training (except at a conference in 2006) or racial profiling.

5. —Special Agent assigned to CJD Fusion Center; employed since

2.8.2010 (interviewed on December 18, 2015 and March 9, 2016)

was accompanied by his union representative, Micah Persons, and attorney for the Criminal Investigators Association (“CIA”), Becky Gallagher. Prior to being assigned to the Fusion Center a year ago, he was assigned to the Internet Crimes Against Children area. He is a police officer and previously worked for the Klamath Falls Police Department. Along with some of his coworkers, he attended the demonstration/training in September 2015 on the use of Digital Stakeout. The trainer showed them how to conduct a “geosearch,” which allows the user to isolate a search to a specific geographic area. During the training, chose to use search terms related to outlaw motorcycle gangs (“OMGs”) because there had been a recent criminal incident in Salem involving one of these gangs.15 After the training they were allowed to continue to use the program on a trial basis. also used the program to monitor social media threats at the state capitol in Salem because there were protests and/or threats going on around that time—e.g., threats made to

15 One of assigned job duties pertains to matters related to OMGs.


13

As part of his job, sometimes would conduct searches as requested by his supervisors or law enforcement agencies on specific matters such as threats at schools. Other times, he would do searches without being requested if the search was based on cases/investigations he had going on or based on “what’s hot in the news.” When used Digital Stakeout to conduct the search, he stated the reason he used that term was because he learned through the news and “flyers” from other agencies that:

There were a lot of protests and law enforcement assaults that were going on throughout the country and the hashtag itself was being used by many different persons that were organizing riots and looting and threats against law enforcement and just social disobedience in general.[16]

also stated that he had been advised by “Portland” (my presumption is that was referring to the Portland Police Bureau) of protests taking place where

bridges and roads were blocked, and that although he had not been given any indication of a threat to public safety or the police, “anytime there’s a riot or any kind of social disobedience there’s always an underlying threat to law enforcement and the public.”

combined the search terms #blacklivesmatter and #fuckthepolice and input them to Digital Stakeout on September 30, 2015 and that there were many results. He focused his search on Salem, Oregon, and many images, names and Twitter and Facebook accounts showed up in the results. looked at the images that appeared and said that one of the images included a police officer in crosshairs with a caption “consider yourselves warned.” was adamant that the image in the crosshairs was definitely a police officer because the person had a typical policeman hat and stance and because the hat is “not a normal hat that somebody wears. That’s definitely a law enforcement hat.”17

16 A search of computer revealed memos from two other states referencing

threats associated with #blacklivesmatter and #fy911 for activity reportedly to take place on September 11, 2015, which was almost three weeks prior to September 30, 2015 Digital Stakeout search on these terms.

17 (and many others) made this assumption. I recognized the image as the logo for the hip hop group Public Enemy and the silhouette in the image as an individual wearing a hat that was popular urban fashion in the rap music industry. Note that Mr. Tweedt also recognized the logo after Mr. Kirby described it in an email. See October 8, 2015 email string attached as Ex. G. Public Enemy member and creator of the logo Chuck D has explained, “The crosshairs logo symbolized the black man in America …. A lot of people thought it was a state trooper because of the hat, but the hat is one of the ones that Run-DMC wore. The B-Boy stance and the silhouette was more like the black man on the target.” Kory Grow, Public Enemy Reveal Origins of Name, Crosshairs Logo, Rolling Stone, Aug. 18 2014, http://www.rollingstone.com/music/news/public-enemy-reveal-origins-of-name-crosshairs-logo-20140818. See also Ex. K.


http://www.rollingstone.com/music/news/public-enemy-reveal-origins-of-name-crosshairs-logo-20140818

http://www.rollingstone.com/music/news/public-enemy-reveal-origins-of-name-crosshairs-logo-20140818

14

He interpreted what he saw to be a threat toward law enforcement, so he clicked on the image, and then found an assortment of other pictures that he considered threats toward law enforcement. When he looked at the name associated with these images, he thought it was Mr. Johnson, the Director of Civil Rights who worked in the building, and he could not imagine him posting “all this hate stuff and especially anti-law enforcement stuff since he worked with us.” He showed the posts, which included Mr. Johnson’s photograph, to who confirmed it was Mr. Johnson. and

encouraged to show the results to Mr. Kirby.

stated that other images on Mr. Johnson’s Twitter page depicted cartoons showing law enforcement to be “complete jerks”; that a political cartoon showing white police officers shooting at a statue of Martin Luther King “makes it appear that law enforcement hate everything that Martin Luther King stood for”; and that his posts were “making all white people appear to be racist.” thinks that anyone who came across Mr. Johnson’s name in a search would hold the same opinion. He felt that Mr. Johnson’s posts showed a lot of hate. was also disturbed by Mr. Johnson’s August 24 post, which depicts what thinks is an image of rap group N.W.A.’s album cover that he remembers seeing when he was approximately 16 years old. He described the image as showing a beat up and bloodied police officer being held in a headlock while the city burns in the background, with the caption, “Three Cheers for Gentrification.”18

does not recall seeing any references to “#fuckthepolice” in Mr. Johnson’s posts, but could not say because that search term was mixed together with the search term he had also entered, and he never did a review of Mr. Johnson’s postings to see whether there was a separate reference to #fuckthepolice. A day or two passed and then the Umpqua Community College shooting happened (on October 1, 2015). Mr. Kirby came by office, and still had Mr. Johnson’s posts up on his computer and showed the crosshairs image to Mr. Kirby, who told him to write a memo that would be provided to management. prepared the memo dated October 1, 2015, attached here as Ex F. He heard nothing further about the memo for a couple of weeks and was then placed on administrative leave on November 10, 2015.

18 I am unaware of any such N.W.A. album cover. The image is actually a photograph of

a painting that hangs in the Know bar on Alberta Street in Portland, Oregon. The neighborhood where the Know is located is widely recognized as a gentrified neighborhood, and the bar is a punk/rock bar. It appears that rather than a post meant to celebrate violence directed at police officers, Mr. Johnson’s caption, “Three Cheers for Gentrification,” may have been intended as an ironic comment about the content of the art work hanging in a punk bar located in a gentrified Portland neighborhood. comments about this post, the crosshairs post and other of Mr. Johnson’s posts demonstrates a possible lack of cultural awareness that may have affected his perception and led him to experience a heightened sense of concern.


15

has seen the Fusion Center Policy Regarding First Amended Protected Events and had read it twice when he started working in the Fusion Center, but he has not had any training on it. He has not seen the Fusion Center Privacy Policy or the Social Media Non-Covert Investigation Policy. Regarding Oregon and federal statutes and regulations that apply to the gathering and maintenance of information on individuals,

is familiar with 28 CFR, but had not heard of ORS §181.575 until he read about the news story surrounding the subject matter of this investigation in the Willamette Week. He has had 28 CFR training on several occasions, most recently in October 2014.

believes the search complied with 28 CFR because he felt he was not collecting or maintaining information, merely searching for it using open source terms that anyone could use. does not believe any search terms are off limits “because you can search for anything you want, but if you start to collect it and maintain it then you have to have a reason.”19

19 While there has been some suggestion that the search itself did not constitute

“collection or maintaining” of information, this does not change the fact that the Fusion Center employees (including ) are bound by the Fusion Center Privacy Policy, which specifically states, in part below, that the Fusion Center will seek or retain information as follows:

4.1 Information That May Be Sought or Retained 1. The Oregon TITAN Fusion Center will seek or retain information only under the

following circumstances: * * *

c. The information is based on a possible threat to public safety or the enforcement of the criminal law; or

d. Where there is reasonable suspicion that a specific individual or organization has committed a criminal offense or is involved in or is planning criminal (including terrorist) conduct or activity that presents a threat to any individual, the community, or the nation, and the information is relevant to the criminal (including terrorist) conduct or activity; or

e. The information is relevant to the investigation and prosecution of suspected criminal (including terrorist) incidents; the resulting justice system response; the enforcement of sanctions, orders, or sentences; or the prevention of crime, or

* * * 3. The Oregon TITAN Fusion Center will not seek or retain information about an

individual or organization solely on the basis of their religious, political, racial, or social views or activities; their participation in a particular non-criminal organization or lawful event; or their race, ethnicity, citizenship, place of origin, age, disability, gender, or sexual orientation.

* * * 5. The information is subject to ORS § 181.575, ORS 192.410-192.505, OAR 137-090-

0000, et seq., 28 CFR Part 23, the United States Constitution and the Oregon Constitution restricting access, use or disclosure.

(continued . . .)


16

stated he has had training regarding racial bias through law diversity classes and the military, as well as when he was with the Klamath Falls Police Department. In mid-September 2005, he had such training through DOJ’s HR department. He has received no anti-racial profiling training, and although he recalls receiving some kind of information in class regarding recognizing what would be considered racial profiling, he does not recall the class, any specifics about it or how long ago he took the class. He received some cultural competency training when he was in the military and with the police department, but he has not had any such training since coming to the DOJ. He has not had any training on implicit or hidden bias.

does not believe the search was inappropriate because “it was a hot topic at the time that was causing riots and people getting injured and killed and public destruction.” He felt the search was no different from a search on OMGs or Volksfront, because #blacklivesmatter is simply a hashtag used by a wide assortment of people to do a wide assortment of things, one of which is to promote violence.20 During the December 18, 2015 interview, stated he had never been told to stop using Digital Stakeout, and that he continued using the program until he was placed on administrative leave on November 10, 2015. However, during the follow-up March 9, 2016 interview, stated that he had been directed to stop using the program by Mr. McIntosh shortly after he generated his October 1, 2015 memo, and that he had actually stopped using it even before Mr. McIntosh’s instruction. did not explain his earlier contradictory statements. 21

(. . . continued)

Oregon TITAN Fusion Center Privacy Policy, at 3-4 (italics added).

20 It is concerning that sees no distinction in this regard between Volksfront, a group founded on the premise of white supremacy and a reported goal to “repatriate minorites”; OMGs, which are known to engage in drug trafficking, crime rings, theft, gang violence, etc.; and #blacklivesmatter, which is a self-described, “online forum intended to build connections between Black people and our allies to fight anti-Black racism, to spark dialogue among Black people, and to facilitate the types of connections necessary to encourage social action and engagement.” See http://blacklivesmatter.com/about/.

21 Note that in the time period between initial December 18, 2015 interview and his March 9, 2016 follow up interview, this investigator learned from the Attorney General’s office that there was concern that the Attorney General’s October 20, 2015 directive to immediately discontinue use of SMMS programs was not immediately communicated to and/or followed by employees. I therefore questioned some employees on when and whether they were verbally notified of the directive any time prior to having received Mr. McIntosh’s November 12, 2015 email. I do not know whether anyone told prior to his follow up interview that the timing of the implementing the directive and when the employees stopped using SMMS programs had become an issue in the investigation. admitted he had the chance to

(continued . . .)


17

does not have the ability to monitor a person’s emails or cell phone usage

without a court order, and the investigators do not conduct surveillance on individuals unless there is an active investigation. makes a distinction between a person making social, political or religious commentary and a person being a potential threat, noting that once the individual starts threatening, implying threats or supporting violence toward specific groups, then “that’s when we need to start paying attention.”

considered the crosshairs image he observed in Mr. Johnson’s posts to be such a threat.

stated that he did not engage in any targeted investigation of Mr. Johnson and that he encountered Mr. Johnson’s social media page by happenstance using hashtags associated with both violent and peaceful behavior.

6. —Special Agent assigned to CJD Internet Crimes Against Children

Task Force; employed since 9.10.2009 (interviewed on December 18, 2015 and March 9, 2016)

was accompanied by his union representative, Mr. Persons, and CIA

attorney, Ms. Gallagher. is a Special Agent assigned to the Internet Crimes Against Children (“ICAC”) Task Force. During the time Digital Stakeout was available to the department, he attempted to use it to view social networking activity of particular individuals he was investigating as part of his ICAC assignment, but was unsuccessful in obtaining useful information. He was notified to discontinue use of Digital Stakeout and any other such monitoring software, but does not recall when or by whom. When conducts internet research, he uses keyword searches focusing on pedophiles and search terms known to be used by people engaged in that type of criminal conduct. He cannot access emails of individuals he is investigating unless the individual gives consent or unless he obtains a search warrant or subpoena. He has heard of 28 CFR §23 and is aware that law enforcement agencies cannot collect or maintain information about the political, religious or social views of an individual unless it directly relates to an investigation of criminal activities, but he does not give much thought to the statute because the information he gathers is always in the context of a criminal investigation. Although he does not recall having received training on 28 CFR §23 or on ORS §181.575, he may have at some point in his career, but it is not a part of any training regimen that exists at DOJ.

(. . . continued) review the transcript from his initial interview prior to his follow up interview, so his unexplained contradiction undermines his credibility.


18

Regarding search that led to this investigation, understanding is that there was no search or profiling of Mr. Johnson, but that there was a search for #blacklivesmatter and for white supremacist groups and OMGs in conjunction with phrases that represent hostility or threats to law enforcement. He understands there was no particular criminal case number open investigating a particular act or person, but that conducting a search regarding threats to police could be perceived to be an investigation of a criminal act. He has seen on the news and social media posts that individuals who have claimed association with the Black Lives Matter movement have made threats against the police.

assisted in conducting research into the October 2015 Umpqua Community College shooting and on that day looked for any connection with the Black Lives Matter movement after seeing speculation in an internet thread that the shooter was associated with the movement.

is not assigned to the Fusion Center, and is unfamiliar with the Fusion Center Privacy Policy, Procedure for Threat Assessments or Policy Regarding First Amended Protected Events. He has seen the Social Media Non-Covert Investigation Policy and believes it applies to him.

has received basic HR harassment training and thinks racial bias training is included with that. He has not received any training on racial profiling or hidden or implicit biases, but thinks he has had diversity training sometime within the last six years.

7. David Kirby—Special Agent in Charge; employed since 9.29.2014 (interviewed on

December 30, 2015)

Mr. Kirby was accompanied during the interview by his attorney, Daniel Thennell. Mr. Kirby is a police officer and his job title is Special Agent in Charge at the Criminal Division of the DOJ. In early 2015, Chief Counsel Tweedt asked Mr. Kirby to research different options for testing social media monitoring software programs the department might purchase as a tool to assist in investigations of criminal matters. Digital Stakeout was one such tool they considered, and some of the CJD employees, including

, participated in a training/demonstration of the product on September 29, 2015. On September 30, Mr. Kirby stopped by office and saw and

in there. told them he had used Digital Stakeout to conduct a keyword search on the terms #blacklivesmatter and #fuckthepolice, isolated the search to Salem, Oregon, and found Mr. Johnson’s Twitter feed containing posts considered troubling. Based on this, Mr. Kirby reported the matter to Mr. Tweedt who checked with Fred Boss, and a decision was made that should prepare a memo about his search and his findings. Upon receiving the instruction to do so, prepared the memo dated October 1, 2015.


19

Mr. Kirby reviewed the memo, which had Mr. Johnson’s Twitter posts attached, and was concerned because his perception at the time was that the image in one of the posts was the silhouette of a police officer in crosshairs. He has since done his own google research on the image, learned that the image was rap group Public Enemy’s logo and learned that the image was not a police officer, but a “hip-hop person in a hip-hop pose, with a hat that was worn by a member of” another rap group. At the time showed Mr. Kirby Mr. Johnson’s tweets, Mr. Kirby did not think delving into Mr. Johnson’s personal postings was problematic because the search

conducted was on open source information, although it may have not been appropriate for to use the search terms he used. Mr. Kirby thinks that with education and training, he and other police officers within the unit may have had a different perception on what the concerning crosshairs image really was. Mr. Kirby would not have conducted the search conducted because he was not concerned with any activity going on with Black Lives Matter, and he tries to make good decisions about things he does or does not do. He recognizes that Black Lives Matter is a movement and that many people with nefarious agendas that have nothing to do with the movement will join and commit criminal activity, such as what happened with the “Occupy” movement. There are many search terms, such as protected class terms based on race, religion, etc., that would be off limits to Mr. Kirby and his employees. Mr. Kirby is part of the management team and is in charge of assigning tasks to the investigators and analysts. assignments include monitoring sovereign citizens, OMGs, individuals making threats on the Attorney General and actual criminal cases. assignments did not include monitoring or gathering information on threats to police, but if information from another agency regarding threats to the police came in, he would review it and make sure the proper people were aware. Mr. McCauley would then review the information and determine whether it conformed with the law (i.e., 28 CFR and other laws regarding privacy rights) before approving it for further dissemination. Mr. Kirby can envision as situation in which it would be appropriate for an employee to conduct a search based on a bulletin received from another law enforcement agency, even if there was no ongoing criminal investigation—for example, if they received a bulletin describing a sovereign citizen who threatened to kill a sheriff. On October 20, 2015, while Mr. Kirby was in Canada conducting active shooter training, he learned during a phone call with Mr. Tweedt and others on the management team that the Attorney General had ordered that the department was to stop using the social media monitoring software. Mr. Kirby understands that Mr. McIntosh then went around the office that day and told the individuals who had been using the software to discontinue doing so. He understands Mr. McIntosh then sent an email on November 12, 2015 with the directive to stop using social media monitoring software.


20

DOJ analysts and investigators cannot without a search warrant or subpoena obtain or view emails, credit card use, banking and financial information, land or cell phone information, etc. of a private citizen. Mr. Kirby does not recall whether he has received training on 28 CFR or the state equivalent ORS §181.575, but understands the common sense parameters that you may not target protected classifications. Mr. Kirby is familiar with the Fusion Center Privacy Policy and the Fusion Center Procedure for Threat Assessments. He does not recall the Fusion Center’s Policy Regarding First Amendment Protected Events and has not seen the Social Media Non-Covert Investigation Policy. Since he has been with the DOJ, Mr. Kirby has not received any training on racial bias in the context of doing his work, but he has in the past as a police officer and has received a lot of diversity training during his career. He has not received training per se regarding racial profiling, but has received training on awareness of it, as well as cultural competency and hidden or implicit bias training, when he was working as an officer for Clackamas County. Mr. Kirby has been in touch with a trainer to provide diversity training for the department that includes a profiling component, and is waiting for approval to proceed with the training.

8. Darin Tweedt—DOJ Chief Counsel22; employed since 2.26.2007 (interviewed on

December 30, 2015)

Mr. Tweedt was accompanied by his attorney, Judy Snyder. The Oregon TITAN Fusion Center Privacy Policy; Social Media Non-Covert Investigation Policy 3-101.5 dated July 31, 2015; and the Fusion Center Procedure for Threat Assessments dated September 18, 2015 apply to all Fusion Center employees. About a year ago, Mr. Tweedt recognized that there was an intelligence gap in the Fusion Center and HIDTA. To address this, he directed Mr. McIntosh and to evaluate social media monitoring software that would allow the user to collect public social media postings with the ability to limit the search to specific terms and geographic areas. This type of program is commonly used by other Fusion Centers around the country, but the Oregon Fusion Center had not yet utilized this type of program. This is how the Digital Stakeout platform came to be tested by certain CJD employees. Some employees also tried out X1 Social Discovery, which has a similar use. In the Fusion Center and HIDTA, the way an analyst typically gets assigned to a case is when there has been a request for assistance from some other law enforcement agency—

22 At the time I interviewed him, Mr. Tweedt was DOJ Chief Counsel. I understand that

his position has since changed and he now serves as a DOJ Assistant Attorney General.


21

e.g., a police officer from some jurisdiction requesting information on a specific person. The Fusion Center would verify that there was an actual ongoing criminal investigation before agreeing to pull together information for the requestor. There was no criminal investigation going on with respect to the Digital Stakeout search

conducted; rather it was the testing of a computer program. The Fusion Center Privacy Policy, on page 7 at paragraph 4, is instructive in listing the applicable prohibitions (on gathering information). At the time the policy was drafted in 2012, the department was not using social media or social media monitoring tools to the extent they are being used now, but the policy still applies to these more modern standard investigation tools. Mr. Tweedt understands from Mr. McCauley that shortly before

conducted the search, attended an annual training by Mr. McCauley that addressed this policy and issues around protected speech. The employees in the department are trained on compliance with 28 CFR and its Oregon equivalent, ORS §181.575,23 and the Fusion Center’s Privacy Policy is drafted to comply with both. The way an employee would be able to extrapolate from the policy to apply it to social media searches is through training and consultation -- specifically, consultation with Mr. McCauley, whose office is located within the Criminal Intelligence Unit so as to be accessible on a day-to-day basis as a resource to employees to ensure their actions are compliant. Since becoming Chief Counsel, Mr. Tweedt has been concerned about the Fusion Center and therefore directed his senior level management to begin a complete review of Fusion Center policies.24 They have since been meeting regularly to review the OARs governing the unit, and have developed draft revised policies that are awaiting review. Mr. Tweedt considers the existing OARs to be out of date. During the process of creating the draft policies, the policy work group has considered many issues that may have addressed the incident involving . Mr. Tweedt has been asked by the Attorney General’s office to hold off on further implementation of the revised policies until the matter involving is resolved.

23 Mr. Tweedt explained that there is a question of whether ORS §181.575 applies to the

DOJ based on the wording of §181.575 and the definitions it references in ORS §181.010, but that he believes the Attorney General would certainly determine it applies to the DOJ and to certified law enforcement officers like

24 One of Mr. Tweedt’s concerns regarding the Fusion Center was that it was operating in an outdated manner with few written policies that were poorly communicated and were insufficient to address relevant issues. There was also a concern as to what information the Fusion Center should be disseminating as bulletins—for example, in the past, the Fusion Center was prepared to report on groups that were assembling in protest even when there was no report of criminal nexus or public safety concern.


22

Conducting a search to gather information on #blacklivesmatter based on information heard in the news may be appropriate even in the absence of a criminal

investigation. Whether it was appropriate would depend on many factors, such as understanding whether the hashtag is one anyone posts to or whether it is identified to a particular recognized group. Common sense should be used, and when common sense fails, departmental policies provide bedrock guidance and Mr. McCauley as the legal advisor should also be consulted. Mr. Tweedt learned that found social media postings by Mr. Johnson that contained possible threats to law enforcement from Mr. Kirby. Mr. Kirby described one particular post to him as the silhouette of a law enforcement officer in the crosshairs of a gun with the caption “you are warned.” Mr. Tweedt immediately contacted Mr. Boss, Deputy Attorney General, explained the situation and recommended that they have

write a report for review by the Attorney General’s office. Mr. Tweedt saw the report (memo) on October 12, 2015 upon his return from out of state. Once he saw October 1, 2015 memo, and reviewed the search terms that had been used (i.e., #blacklivesmatter and #fuckthepolice), he became very concerned because of the possibility that ORS §181.575 had been violated, and also because he has worked very hard to prevent any perception that the CJD is engaging in investigating or collecting data on people’s exercise of their constitutional rights. He felt that the images were to a certain degree “not as [previously] advertised” to him, and the concerns he had about the potential threat to police officers prior to reviewing the memo were much diminished. He still had a concern that negative postings about the police could reflect very poorly on the Attorney General. After reviewing the memo, he passed it on to Mr. Boss on October 13, 2015. On October 20, 2015, Mr. Tweedt was summoned to meet with Attorney General Rosenblum and Mr. Boss. The Attorney General was very angry about the memo, as she believed had engaged in racial profiling. The Attorney General ordered Mr. Tweedt to find anti-racial profiling training for the Special Agents in the division. On November 10, 2015, Mr. Boss notified Mr. Tweedt that there was going to be an HR investigation of and that he was to be put on administrative leave effective that day. Mr. Tweedt is not certain that conducting a search by itself constitutes “collecting” or “gathering” information. The “collecting” of information by in this instance was directed by the Deputy Attorney General (by virtue of having directed

to prepare the memo). There is little guidance for agencies on this issue, and reasonable people could differ on whether running a search without saving the data constitutes “collection.” Mr. Tweedt believes that some of Mr. Johnson’s posts may be construed as threatening to law enforcement officers when taken out of context by people who do not know Mr. Johnson, but Mr. Tweedt knows him and does not find the posts to be threatening.


23

9. —Research Analyst 4; employed with DOJ for the last 10 years (interviewed on January 7, 2016 and March 16, 2016)

was accompanied by her union representative, Mr. Ederer. She is supervised

by Mr. McIntosh and assigned to the HIDTA of the CJD, which is co-located with the Fusion Center.

did not receive the demonstration/training for Digital Stakeout, but was aware the Fusion Center was testing the program. Within a day or so after the training, she asked to show her how to use it because she did not have access.

stated that during that timeframe, there was a lot of nationwide social media buzz about the Black Lives Matter movement and threats against the police and police officers being murdered by people using that hashtag. stated that

told her he was going to “see if we had any of those violent type people in our area that could be of concern…not specifically targeting supporters that are using that, but looking for any viable threats to law enforcement.” She said that input the search terms #blacklivesmatter and #fuckthepolice “because those two were being used pretty regularly with…some… that were calling for the massacre of police officers and white people….” The search results showed Mr. Johnson’s posts.25

felt the posts were very derogatory toward law enforcement, and they included an image of a silhouette of a police officer in crosshairs. She never heard that the silhouette was not a police officer and stated “that’s exactly what it looked like.” All the other posts were showing police officers being threatening, incompetent or targeting black people.

asked Mr. McCauley to look at the posts as they (she and ) were concerned with the crosshairs image because it included the language, “you’ve been warned.” was concerned because there were police officers in the building and it appeared to her that this constituted a threat to police. Mr. McCauley agreed that management should be notified because explained to him that the purpose of searching those hashtags was because they were being used across the country for threats against law enforcement and white people on a regular basis, with people calling for the massacre of police officers. She based this on what she said were social media posts regarding people using the hashtag, including “news articles of a black lady making threats…and they actually arrested her.” said that the hashtag “had been utilized repeatedly with the ambush and murder of police officers,” and that she is not aware of any other hashtags that she has seen recently that are consistent with threats to the police. husband is a police officer and had previously been a police officer. acknowledged that there were many people that have also used the #blacklivesmatter in noncriminal, nonthreatening ways.

25 Note that none of Mr. Johnson’s tweets that were attached to October 1,

2015 memo contained any reference to “fuck the police.”


24

stated that along with herself and , Mr. McCauley, and Mr. Kirby came into office and looked at Mr. Johnson’s

posts that were up on computer screen, and that no one expressed concern that the search was inappropriate. is aware that was asked to write up an explanation of the search that was to be given to Chief Counsel Tweedt.

is not aware of anyone besides Mr. Johnson whose social media account had been reviewed using Digital Stakeout. As a Research Analyst, role is to support law enforcement with its cases, specifically drug cases. She receives her case assignments when a law enforcement agency calls and requests assistance, but she does not take it upon herself to conduct unrequested research not related to a case. As part of her research, she checks publicly available social media sites such as Facebook. There is always a particular target to the investigation where there has been criminal activity. In conducting her research, she distinguishes between individuals making a threat and individuals making social, political or religious commentary based on how a reasonable person would view it.

is familiar with and has received training on 28 CFR and feels it applies to all the work she does. She also knows that ORS §181.575 applies to her work, given that these laws and related regulations and administrative rules are all listed in the department’s Privacy Policy. She believes these laws and rules applied to the search and review of Mr. Johnson’s twitter posts. has received training on how to eliminate personal opinion biases in writing, and that training has touched on ethnic, national origin, religious and other biases. She has not received anti-racial profiling, cultural competency or hidden bias training, but believes she has received some diversity training within the last couple of years.

is familiar with department’s Social Media Non-Covert Investigation Policy. She has not received the Fusion Center Policy Regarding First Amendment Protected Events because she does not work for the Fusion Center. She is aware of the Fusion Center Privacy Policy because it has been made applicable to the entire Criminal Intelligence Center.

10. Steven McIntosh—Assistant Special Agent in Charge of CJD; employed with DOJ for

six years (interviewed on January 7, 2016)

Mr. McIntosh was unaccompanied by any representative during his interview. Mr. McIntosh is in charge of the Criminal Intelligence Unit and the ICAC Task Force. Digital Stakeout is a social media monitoring tool that collects publicly accessible information from social media sites, and is used by most Fusion Centers and by other agencies within Oregon. It was being tested in the Fusion Center by ,

, , and . Mr. McIntosh instructed them to test it out while doing their case work and give him their thoughts on it. The work done by the employees under his supervision includes assisting other law enforcement agencies by conducting analytical work on criminal investigations, conducting internal


25

investigations and assisting in requests for threat assessments. Mr. McIntosh has a document he refers to as the Fusion Center Roles and Responsibilities that specifies the tasks and priorities assigned to each of his subordinates. For any Criminal Intelligence Unit employee to conduct a search for any reason, a reasonable suspicion of a crime must exist, as the employee would not simply do a search on an individual or entity if there is no criminal predicate. This is mandated by the various federal and state data collection laws. Mr. McIntosh does not know whether

had a reasonable suspicion when he conducted the search and has not delved any further into it because he was aware this investigation was taking place. Around September 10, 2015, the Fusion Center issued a report in its weekly bulletin advising that members of #blacklivesmatter and #fy911 social media users were calling for the murder of police officers on a site called Blog Talk Radio. Mr. McIntosh believes this would represent reasonable suspicion of a crime sufficient to warrant a search being done by one of his investigators. The timeframe that the reasonable suspicion would be limited to would be right around September 11, but he cannot give me an exact timeframe. If the report they received included information stating an event was “going to happen yesterday,” they would not go any further because the danger would have ended before they were alerted of the problem. The September 10, 2015 Fusion Center report stated that the Fusion Center was not aware of any specific threat directed to Oregon law enforcement, but recommended extreme caution to be exercised “over the weekend” of September 11. Mr. McIntosh is not aware of any individual besides Mr. Johnson whose social media activity was viewed in this way, and has heard of no employee other than who conducted a search that turned up information on individuals that were not related to a crime. He is unaware of any individuals within the CJD who have done searches that were inappropriate or illegal. The September 18, 2015 Fusion Center Procedure on Threat Assessments was written and implemented by Mr. McIntosh because the Fusion Center was not keeping good statistics on the threat assessments it was conducting. He disseminated this procedure to employees via email. The Fusion Center’s Social Media Non-Covert Investigation Policy was disseminated in July 2015—it describes how social media can be used and applies to the types of investigations conducted by the CJD. This policy requires written supervisor authorization in order to conduct passive viewing of websites. In October or November, 2015, after the incident involving came to light, Mr. McIntosh sent such authorizations to the analysts. The Fusion Center Privacy Policy was in effect prior to Mr. McIntosh’s arrival, and it is in the process of being changed. Mr. McIntosh is also implementing training on the Privacy Policy to be conducted every February.


26

Mr. McIntosh verbally informed Fusion Center employees to stop using social media monitoring software (including Digital Stakeout) at the end of October and again via email several weeks later. Mr. McIntosh does not know whether the employees have received any training on racial bias in the context of determining whether and when to gather information. The department received diversity training several years ago. He is not aware of any training the employees received on cultural competency or implicit or hidden bias.

11. Matt McCauley—Assistant Attorney General; employed with DOJ for 13 years

(interviewed on December 15, 2015)

Mr. McCauley was accompanied by the attorney for the Oregon Association of Justice Attorneys, Jennifer Chapman. Mr. McCauley is assigned to the CJD Criminal Intelligence Center, and half of his assignment involves acting as the legal advisor to the Criminal Intelligence Unit. The Criminal Intelligence Center regularly receives information bulletins from other agencies or jurisdictions and disseminates information to other agencies. Mr. McCauley reviews the information they collect, share, disseminate, store and discard for legal compliance with the OARs, 28 CFR and the Fusion Center Privacy Policy. Approximately once a year or whenever requested by the Fusion Center, Mr. McCauley also provides training on 28 CFR §23, ORS §181.575 and the Fusion Center Privacy Policy (which Mr. McCauley describes collectively as having slightly different wording of all the same concepts). He gave his last overview on the relevant privacy laws at a law enforcement conference in Bend, Oregon in March of 2015. See email and attached training materials, attached as Ex. L. This conference was attended by Mr. McCauley regularly instructs the CJD Criminal Intelligence Center employees to come to him whenever they encounter “red flags” in the course of gathering information—i.e., any information that affects the protected class for which there may be a question on whether there is reasonable suspicion of a crime. For example, if a bulletin came in from another state’s Fusion Center and the employee sees a “red flag” issue, the employee will come to Mr. McCauley and Mr. McCauley will ask targeted questions to determine whether the information complies with the law and the department’s rules. Mr. McCauley recalls that the Fusion Center in the past received requests for information from other agencies related to Black Lives Matter, but that the Fusion Center did not issue any reports specific to Black Lives Matter because there was no probable cause in Oregon of anybody associated with the movement committing a crime. Mr. McCauley acknowledged that there was a report issued from the Fusion Center on around September 10, 2015 advising that members of #blacklivesmatter and #fy911 social media users were calling for the murder of police officers on a site called Blog Talk Radio. The report noted that the Fusion Center was not aware of any specific threat directed to Oregon law enforcement, but recommended extreme caution to be exercised “over the weekend” of September 11. Mr. McCauley was in court and unavailable when


27

the decision to issue this memo was made, and the memo was approved by due to the unavailability of Mssrs. McCauley and McIntosh. If Mr. McCauley

had been available, they would have “had a hard discussion” about whether to publish it.

did not come to Mr. McCauley to engage in any discussion prior to running his search. showed Mr. McCauley the search results that were displayed on

computer, specifically an image that Mr. McCauley described as a silhouette of a police officer’s head in crosshairs with the caption, “you are warned” and an image Mr. McCauley described as a photo of a painting of “several young men beating up a cop.” told Mr. McCauley that he had been experimenting or “playing around” with (the Digital Stakeout) software, and that he had run the search. This caused Mr. McCauley “serious concerns” because Black Lives Matter is obviously a political movement, and this raised a red flag of the type Mr. McCauley has had numerous discussions with in the past in the context of discussing OMGs. If had come to Mr. McCauley before conducting the search, as he has in past situations, Mr. McCauley would have put the issue through the process he uses when a red flag is involved. Mr. McCauley stated that the department does not move forward unless there exists “an articulated reasonable suspicion.” The reason it has the rules in place today is because of how Hoover and the FBI handled Martin Luther King and other civil rights groups back in the 1950s, 1960s and 1970s. Mr. McCauley’s job includes doing a balancing act between public safety and civil liberties. If a political movement such as “Occupy” is protesting, and the protests are infiltrated by anarchists, this would not be reported as crimes committed by “Occupy” simply because a criminal group of anarchists utilized the protest to commit crimes under their own agenda. If was conducting the search because he believed Black Lives Matter presented a threat to police, he would need to show Mr. McCauley “the probable cause…the reasonable suspicion of criminal behavior.” Reasonable suspicion is based on the officer’s knowledge of all the events, training and experience, so in order to determine whether it existed with respect to search, there would have been a discussion among , Mr. McIntosh, Mr. McCauley and others, with Mr. McIntosh making the final call if had come to Mr. McCauley prior to conducting the search. Mr. McCauley’s advice to would have been to run other hashtags unrelated to #blacklivesmatter if the purpose was to get at threats to the police, given that there are other hashtags that are more pointedly violent, and there would be no need to use a hashtag related to the Black Lives Matter movement. Mr. McCauley thinks that in order for actions to constitute collecting/gathering information, he would have had to have somehow stored it. Mr. McCauley’s understanding is that was told to make a copy of the search results by management. Mr. McCauley is unaware of whether the CJD has provided training to its employees on racial bias or anti-racial profiling. Mr. McCauley has helped Mr. Kirby draft an anti-profiling policy that will be modified and applied to the entire CJD. Mr. McCauley and


28

Mr. McIntosh are planning to conduct annual training for every employee in the Criminal Intelligence Unit on all the policies, including the racial profiling policies that are being developed. Mr. McIntosh has drafted a policy regarding the use of social media tools within the Criminal Intelligence Center, and the goal was to have this policy disseminated by January 1, 2016.

V. Conclusions and Recommendations

Based on my investigation to date, I do not believe there is widespread behavior/actions by CJD Intelligence Unit employees like that engaged in by regarding his search of #blacklivesmatter postings. It appears to have been an isolated incident prompted by the testing of the software Digital Stakeout, and I do not believe that a further department-wide internal audit into employees’ searching for information on individuals or groups is necessary.

The Intelligence Unit employees have varying levels of understanding whether 28 CFR §

23 applies to the CJD investigators/analysts, although most seem to accept that it does. The employees also have varying levels of knowledge/awareness of ORS §181.575 (now recodified as ORS §181A.250). Despite the fact there has been training given as recently as March 2015 on the applicability of these statutes to the employees, not all have attended or recollect the training.

Some employees questioned whether 28 CFR § 23 and ORS § 181.575 apply to the CJD

investigators/analysts in conducting open source internet searches and whether such a search alone constitutes “collecting” or “maintaining” data if the search is not saved or printed out. Assuming arguendo that the statutes do not apply to a simple Google search, for example, I think the argument fails when applied to a SMMS program like Digital Stakeout. The very nature and presumably the most beneficial use of Digital Stakeout is that it searches various social media sites and gathers or collects the data into a single onscreen location/format that can then be accessed by the user of the product. Information, “such as screen name, hashtags, mentions, urls, generator and content type are automatically extracted and stored as [searchable] fields”26 on the user’s computer screen.

In any event, the CJD privacy/first amendment policies are sufficiently clear to suggest that

such a search is not acceptable unless based upon a possible public safety threat or reasonable suspicion that an individual or organization has committed or is planning to commit a crime.

search using the search term #blacklivesmatter (even combined with

#fuckthepolice) was not in compliance with the statutes, regulations and departmental rules applicable to the CJD employees. stated that, “[d]ue to increased threats toward law enforcement, I used a hashtag search for, ‘fuckthepolice,’ and ‘blacklivesmatter,’ which are keywords and hashtags known for posting threats towards law enforcement.” However,

search was not tied to a criminal investigation and there were no reasonable grounds to believe there was an existing threat in the Salem area at the time he conducted his search.

26 See http://www.digitalstakeout.com/threat-intelligence-platform (italics added).


http://www.digitalstakeout.com/threat-intelligence-platform

29

may assert that along with news media reports from other parts of the country, he relied on bulletins received from other law enforcement agencies that alerted CJD employees of threats associated with #blacklivesmatter. I obtained copies of such bulletins from a search of computer. The bulletins I reviewed came from two intelligence agencies outside the state of Oregon within the week leading up to September 11, 2015. These bulletins addressed perceived threats of protests and violence to take place specifically targeted to September 11, 2015 that were alleged to have been made on a site called blog radio. The bulletins asserted that these threats were associated with the terms #blacklivesmatter and #fy911, among others.27 I did not find any post-September 11, 2015 bulletins that contained such warnings.

did not conduct his search until September 30, 2015, almost three weeks

after the September 11 target date. Further, according to Mr. McCauley, told him he was just playing around with the software to see what it could do, as opposed to conducting a search related to an active criminal investigation. The search results yielded Twitter posts made by Mr. Johnson. However, Mr. Johnson had not made any threats, and rather appears to have been expressing his dissatisfaction with incidents of police shootings of or biased behavior toward African Americans. Rather than depicting threats to the police, the majority of the law enforcement related posts by Mr. Johnson appear to be satirical cartoon images depicting threats from the police toward African Americans. These postings are protected by Mr. Johnson’s First Amendment rights to free speech. Thus there should have been no continued viewing, documentation, sharing with others or any other action based on the tweets.

Based on the description by to his supervisors of Mr. Johnson’s postings

constituting violent threats toward police officers, and based on the lack of recognition by and others of an alternative point of view of what postings actually depicted or

represented, it is not surprising that he was directed to prepare a memo on the matter.

There is a lack of training on anti-racial profiling28 and/or anti-bias in the workplace as applied to law enforcement/support activities. Further, there appears to be a lack of racial

27 Note that these bulletins contained privacy statements generally prohibiting their

dissemination, so I have not attached them to this report.

28 The American Civil Liberties Union (“ACLU”) describes racial profiling as follows: “‘Racial Profiling’ refers to the discriminatory practice by law enforcement officials of targeting individuals for suspicion of crime based on the individual’s race, ethnicity, religion or national origin.” Oregon House Bill 2002, signed into law on January 2015, directs law enforcement agencies to adopt written policies and procedures prohibiting profiling by January 1, 2016 (note, this requirement was not in effect at the time of the incident that led to this investigation and is being included herein for the purpose of providing the definition of profiling under Oregon law). Under Oregon law, profiling is described as when “a law enforcement agency or a law enforcement officer targets an individual for suspicion of violating a provision of law based solely on the real or perceived factor of the individual’s age, race, ethnicity, color, national origin, language, gender, gender identity, sexual orientation, political affiliation, religion,

(continued . . .)


30

diversity and cultural competency within the CJD that may have contributed to the situation that prompted this investigation. The CJD should proceed with the Attorney General’s directive to provide anti-racial profiling to the Intelligence Unit, and should implement mandatory training in the related and often overlapping areas of diversity, cultural competency and anti-bias training. The CJD should also focus on increasing the racial and ethnic diversity within the Intelligence Unit.

The Intelligence Unit as a whole would benefit from clear and consistent leadership and

direction regarding applying the relevant statutes and regulations to their daily activities, specifically with respect to electronic monitoring of social media. This training should be mandatory, documented and monitored for compliance, and refresher training should be provided at scheduled intervals.

(. . . continued) homelessness or disability, unless the agency or officer is acting on a suspect description or information related to an identified or suspected violation of a provision of law.”


Documents

Submitted April 6, 2016 by Carolyn D. Walker, Attorney Stoel ...media.oregonlive.com/politics_impact/other/investigation.pdfCarolyn D. Walker, Attorney Stoel Rives LLP Case 6:16-cv-02052-TC